auth:
  type: OAUTH2
  oauth2:
    client:
        keycloak:
          clientId: kafka-ui
          clientSecret: DOqoDQvIrk7ikkR9q0WKmJg3O3b10igW
          scope: openid
          issuer-uri: http://kubernetes.docker.internal:8081/realms/kafka
          user-name-attribute: preferred_username
          client-name: keycloak
          provider: keycloak
          custom-params:
            type: oauth
            roles-field: groups
rbac:
  enabled: true
  roles:
  - name: "admins"
    clusters:
      - kafka-cluster
    subjects:
      - provider: oauth
        type: role
        value: "Admin"
    permissions:
      - resource: applicationconfig
        actions: [VIEW, EDIT]
      - resource: clusterconfig
        actions: [VIEW, EDIT]
      - resource: topic
        value: ".*"
        actions: [VIEW, CREATE, EDIT, DELETE, MESSAGES_READ, MESSAGES_PRODUCE, MESSAGES_DELETE]
      - resource: consumer
        value: ".*"
        actions: [VIEW, DELETE, RESET_OFFSET]
      - resource: schema
        value: ".*"
        actions: [VIEW, CREATE, DELETE, EDIT, MODIFY_GLOBAL_COMPATIBILITY]
      - resource: connect
        value: ".*"
        actions: [VIEW, EDIT, CREATE, RESTART]
      - resource: ksql
        actions: [EXECUTE]
      - resource: acl
        actions: [VIEW, EDIT]

  - name: "editors" 
    clusters:
      - kafka-cluster
    subjects:
      - provider: oauth
        type: role
        value: "Editor"
    permissions:
      - resource: applicationconfig
        actions: [VIEW]
      - resource: clusterconfig
        actions: [VIEW]
      - resource: topic
        value: ".*"
        actions: [VIEW, EDIT, MESSAGES_READ, MESSAGES_PRODUCE, MESSAGES_DELETE]
      - resource: consumer
        value: ".*"
        actions: [VIEW, RESET_OFFSET]
      - resource: schema
        value: ".*"
        actions: [VIEW, CREATE, DELETE, EDIT, MODIFY_GLOBAL_COMPATIBILITY]
      - resource: connect
        value: ".*"
        actions: [VIEW, EDIT, CREATE, RESTART]

  - name: "readonly"
    clusters:
      - kafka-cluster
    subjects:
      - provider: oauth
        type: role
        value: "Viewer"
    permissions:
      - resource: applicationconfig
        actions: [VIEW]
      - resource: clusterconfig
        actions: [VIEW]
      - resource: topic
        value: ".*"
        actions: [VIEW, MESSAGES_READ]
      - resource: consumer
        value: ".*"
        actions: [VIEW]
      - resource: schema
        value: ".*"
        actions: [VIEW]
      - resource: connect
        value: ".*"
        actions: [VIEW]
